chinese_generic_botnet | eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
27-08-2023 00:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
Size

380KB
MD5

f9e0ed4ee974d1b0482d4ddafc145c5c
SHA1

abf8bb1f876a624780b69148d3bfac4b1b5d1699
SHA256

eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede
SHA512

7d0edcb2c70a422ad9b9a0b0e0847a9b214d1ba91a7bf062419f990858110972834fc5fe6bdd56a4673f77d2bf67a91c7e409c5424f889ca64e069721bb6a4fe
SSDEEP

3072:cmgg0YcfYYOR3YtyV2GenT0cTtm2LAQSXVqjzpYfJh9Y5:9ggLcfzOr2GenQ67wk3pyJh9Y5

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 3 IoCs

botnet

resource	yara_rule
behavioral2/memory/4400-12-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet
behavioral2/memory/4084-13092-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet
behavioral2/memory/4084-13095-0x0000000000400000-0x000000000052B000-memory.dmp	unk_chinese_botnet

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
4084	xzw.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Terms.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe"	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Suaeweq.exe = "C:\\windowss64\\xzw.exe"	xzw.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\B:	xzw.exe
File opened (read-only)	\??\J:	xzw.exe
File opened (read-only)	\??\K:	xzw.exe
File opened (read-only)	\??\S:	xzw.exe
File opened (read-only)	\??\T:	xzw.exe
File opened (read-only)	\??\Y:	xzw.exe
File opened (read-only)	\??\Q:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\S:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\T:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\Z:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\G:	xzw.exe
File opened (read-only)	\??\I:	xzw.exe
File opened (read-only)	\??\R:	xzw.exe
File opened (read-only)	\??\B:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\I:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\L:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\M:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\N:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\L:	xzw.exe
File opened (read-only)	\??\Q:	xzw.exe
File opened (read-only)	\??\R:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\E:	xzw.exe
File opened (read-only)	\??\M:	xzw.exe
File opened (read-only)	\??\U:	xzw.exe
File opened (read-only)	\??\O:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\P:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\U:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\N:	xzw.exe
File opened (read-only)	\??\W:	xzw.exe
File opened (read-only)	\??\Z:	xzw.exe
File opened (read-only)	\??\E:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\H:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\W:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\Y:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\O:	xzw.exe
File opened (read-only)	\??\X:	xzw.exe
File opened (read-only)	\??\V:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\X:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\G:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\K:	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
File opened (read-only)	\??\H:	xzw.exe
File opened (read-only)	\??\P:	xzw.exe
File opened (read-only)	\??\V:	xzw.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 34 IoCs

pid	Process
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe
4084	xzw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4400	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
4400	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
4084	xzw.exe
4084	xzw.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 1988	4400	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe	82
PID 4400 wrote to memory of 1988	4400	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe	82
PID 4400 wrote to memory of 1988	4400	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe	82
PID 4400 wrote to memory of 4084	4400	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe	89
PID 4400 wrote to memory of 4084	4400	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe	89
PID 4400 wrote to memory of 4084	4400	eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe	89

C:\Users\Admin\AppData\Local\Temp\eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe
"C:\Users\Admin\AppData\Local\Temp\eb29ebabe206a22520ca5dc77982b4b4412872571013ae78fcfe8f39d7769ede.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c md C:\windowss64
  2⤵
  PID:1988
- C:\windowss64\xzw.exe
  "C:\windowss64\xzw.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\windowss64\xzw.exe

Filesize
888KB

MD5
a60eb6b05e9aa663aa574603aa4b7688

SHA1
1bea14088e5fa1d7e46a4a1d7f3c3fa5b395c7f8

SHA256
9387843ba50bc2600c26e7fe86b6d40e1dc5db5d685dbbf681cbcb50eb6cab5e

SHA512
678744d6831d2736b913fe9a5c4d3f7ce077c78eb5ec1f187228541e57501ddc0ed5b5dab43a682590bb50a858503ea5936304c325fa457aef0129c82805f370

Download Submit
C:\windowss64\xzw.exe

Filesize
888KB

MD5
a60eb6b05e9aa663aa574603aa4b7688

SHA1
1bea14088e5fa1d7e46a4a1d7f3c3fa5b395c7f8

SHA256
9387843ba50bc2600c26e7fe86b6d40e1dc5db5d685dbbf681cbcb50eb6cab5e

SHA512
678744d6831d2736b913fe9a5c4d3f7ce077c78eb5ec1f187228541e57501ddc0ed5b5dab43a682590bb50a858503ea5936304c325fa457aef0129c82805f370

Download Submit
C:\windowss64\xzw.exe

Filesize
888KB

MD5
a60eb6b05e9aa663aa574603aa4b7688

SHA1
1bea14088e5fa1d7e46a4a1d7f3c3fa5b395c7f8

SHA256
9387843ba50bc2600c26e7fe86b6d40e1dc5db5d685dbbf681cbcb50eb6cab5e

SHA512
678744d6831d2736b913fe9a5c4d3f7ce077c78eb5ec1f187228541e57501ddc0ed5b5dab43a682590bb50a858503ea5936304c325fa457aef0129c82805f370

Download Submit
memory/4084-13090-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4084-15-0x00000000755D0000-0x00000000757E5000-memory.dmp

Filesize
2.1MB

Download
memory/4084-3891-0x0000000077350000-0x00000000774F0000-memory.dmp

Filesize
1.6MB

Download
memory/4084-5900-0x0000000077590000-0x000000007760A000-memory.dmp

Filesize
488KB

Download
memory/4084-13085-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4084-13086-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4084-13087-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4084-13088-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4084-11-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4084-13091-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4084-13092-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/4084-13095-0x0000000000400000-0x000000000052B000-memory.dmp

Filesize
1.2MB

Download
memory/4400-12-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download